[syzbot] [sctp?] kernel BUG in __pskb_pull_tail (2)

[syzbot] [sctp?] kernel BUG in __pskb_pull_tail (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    21a7f44fd076 Merge tag 'devicetree-for-7.4' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1299b469580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b92e3106016c03ef
dashboard link: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-21a7f44f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9b86d9af9ad5/vmlinux-21a7f44f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/6f435992c0d2/bzImage-21a7f44f.xz

AI-generated root cause summary:
When receiving an SCTP packet that is nonlinear (such as an SCTP GSO packet
constructed with fragments in frag_list), sctp_rcv attempts to linearize the
packet using skb_linearize() if the sk_buff is cloned (e.g., tapped by a packet
socket or shared) or not recognized as GSO. During linearization via
__skb_linearize() and __pskb_pull_tail(), skb_copy_bits() fails with -EFAULT due
to a discrepancy in frag_list fragment lengths or readable offsets, triggering a
BUG_ON assertion failure. In production builds, this BUG() results in an invalid
opcode oops and kernel panic, causing an immediate denial of service.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=f15a6eff7a53f6eb7dc3

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2903!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 8843 Comm: syz.2.816 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 61 f8 48 89 df e8 6b 03 fe ff 31 ff 41 89 c4 89 c6 e8 af c5 61 f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 8c cb 61 f8 90 <0f> 0b e8 84 cb 61 f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000007870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff888031daa580 RSI: ffffffff89ac4f84 RDI: ffff888031daa580
RBP: ffffc900000078f0 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000fffffff2 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff88803a46bb80
FS:  00007fa1c8fde6c0(0000) GS:ffff8880d44ac000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000037f0f000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __skb_linearize include/linux/skbuff.h:4025 [inline]
 skb_linearize include/linux/skbuff.h:4037 [inline]
 sctp_rcv+0x143e/0x3cc0 net/sctp/input.c:120
 ip_protocol_deliver_rcu+0x44c/0x4d0 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3fb/0x6e0 net/ipv4/ip_input.c:241
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_local_deliver+0x1a3/0x200 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:481 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6405
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6518
 process_backlog+0x487/0x1600 net/core/dev.c:6869
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7938
 napi_poll net/core/dev.c:8001 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8158
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
 __dev_queue_xmit+0xa73/0x4a50 net/core/dev.c:5101
 dev_queue_xmit include/linux/netdevice.h:3483 [inline]
 neigh_hh_output include/net/neighbour.h:538 [inline]
 neigh_output include/net/neighbour.h:552 [inline]
 ip_finish_output2+0xfa4/0x2740 net/ipv4/ip_output.c:236
 __ip_finish_output.part.0+0x43b/0x6f0 net/ipv4/ip_output.c:314
 __ip_finish_output net/ipv4/ip_output.c:302 [inline]
 ip_finish_output net/ipv4/ip_output.c:324 [inline]
 NF_HOOK_COND include/linux/netfilter.h:314 [inline]
 ip_output+0x392/0xc00 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
 __ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533
 sctp_v4_xmit+0x91a/0x1070 net/sctp/protocol.c:1061
 sctp_packet_transmit+0x22fe/0x30b0 net/sctp/output.c:659
 sctp_outq_flush_transports net/sctp/outqueue.c:1174 [inline]
 sctp_outq_flush+0xb2b/0x3380 net/sctp/outqueue.c:1222
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1826 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline]
 sctp_do_sm+0xce1/0x5c30 net/sctp/sm_sideeffect.c:1182
 sctp_assoc_bh_rcv+0x392/0x740 net/sctp/associola.c:1048
 sctp_inq_push+0x25c/0x320 net/sctp/inqueue.c:91
 sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:331
 sk_backlog_rcv include/net/sock.h:1194 [inline]
 __release_sock+0x39d/0x440 net/core/sock.c:3341
 release_sock+0x1e5/0x280 net/core/sock.c:3940
 sctp_sendmsg+0x1166/0x22e0 net/sctp/socket.c:2091
 inet_sendmsg+0x11c/0x140 net/ipv4/af_inet.c:864
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0xa23/0xc30 net/socket.c:2715
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
 __sys_sendmmsg+0x20c/0x440 net/socket.c:2858
 __do_sys_sendmmsg net/socket.c:2885 [inline]
 __se_sys_sendmmsg net/socket.c:2882 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2882
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa1c819f559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa1c8fde028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007fa1c8426180 RCX: 00007fa1c819f559
RDX: 0000000000000001 RSI: 00002000000004c0 RDI: 0000000000000006
RBP: 00007fa1c8236b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa1c8426218 R14: 00007fa1c8426180 R15: 00007fff741e8248
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 61 f8 48 89 df e8 6b 03 fe ff 31 ff 41 89 c4 89 c6 e8 af c5 61 f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 8c cb 61 f8 90 <0f> 0b e8 84 cb 61 f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000007870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff888031daa580 RSI: ffffffff89ac4f84 RDI: ffff888031daa580
RBP: ffffc900000078f0 R08: 0000000000000005 R09: 0000000000000000
R10: 00000000fffffff2 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff88803a46bb80
FS:  00007fa1c8fde6c0(0000) GS:ffff8880d44ac000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000037f0f000 CR4: 0000000000352ef0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [sctp?] kernel BUG in __pskb_pull_tail (2)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    05441d697f7f Merge tag 'cocci-7.4-rc1' of git://git.kernel..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=162b8add580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=1cf189394a856f11
dashboard link: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11b49b29580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=15b49b29580000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-05441d69.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0edd3964be19/vmlinux-05441d69.xz
kernel image: https://storage.googleapis.com/syzbot-assets/84d6d8dd5648/bzImage-05441d69.xz

AI-generated root cause summary:
When receiving an SCTP packet that is nonlinear (such as an SCTP GSO packet
constructed with fragments in frag_list), sctp_rcv attempts to linearize the
packet using skb_linearize() if the sk_buff is cloned (e.g., tapped by a packet
socket or shared) or not recognized as GSO. During linearization via
__skb_linearize() and __pskb_pull_tail(), skb_copy_bits() fails with -EFAULT due
to a discrepancy in frag_list fragment lengths or readable offsets, triggering a
BUG_ON assertion failure. In production builds, this BUG() results in an invalid
opcode oops and kernel panic, causing an immediate denial of service.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=f15a6eff7a53f6eb7dc3

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com

------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2903!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 2 UID: 0 PID: 6002 Comm: syz.0.20 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 5b f8 48 89 df e8 2b 03 fe ff 31 ff 41 89 c4 89 c6 e8 7f 58 5b f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 5c 5e 5b f8 90 <0f> 0b e8 54 5e 5b f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000648870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff88802ce60000 RSI: ffffffff89b30684 RDI: 0000000000000005
RBP: ffffc900006488f0 R08: 0000000000000000 R09: 00000000fffffff2
R10: ffff888046a12f77 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff888030406780
FS:  000055558120b500(0000) GS:ffff8880d467c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001a000 CR3: 00000000385f5000 CR4: 0000000000352ef0
Call Trace:
 <IRQ>
 __skb_linearize include/linux/skbuff.h:4025 [inline]
 skb_linearize include/linux/skbuff.h:4037 [inline]
 sctp_rcv+0x143e/0x3cc0 net/sctp/input.c:120
 ip_protocol_deliver_rcu+0x44c/0x4d0 net/ipv4/ip_input.c:207
 ip_local_deliver_finish+0x3fb/0x6e0 net/ipv4/ip_input.c:241
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_local_deliver+0x1a3/0x200 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:481 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6433
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6546
 process_backlog+0x487/0x1600 net/core/dev.c:6897
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7966
 napi_poll net/core/dev.c:8029 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8186
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 ipt_do_table+0xd71/0x1b10 net/ipv4/netfilter/ip_tables.c:357
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:633
 nf_hook include/linux/netfilter.h:280 [inline]
 __ip_local_out+0x541/0xb80 net/ipv4/ip_output.c:120
 ip_local_out+0x2a/0x1f0 net/ipv4/ip_output.c:129
 __ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533
 sctp_v4_xmit+0x91a/0x1070 net/sctp/protocol.c:1061
 sctp_packet_transmit+0x22fe/0x30b0 net/sctp/output.c:659
 sctp_outq_flush_transports net/sctp/outqueue.c:1174 [inline]
 sctp_outq_flush+0xb2b/0x3380 net/sctp/outqueue.c:1222
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1826 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline]
 sctp_do_sm+0xce1/0x5c30 net/sctp/sm_sideeffect.c:1182
 sctp_assoc_bh_rcv+0x392/0x740 net/sctp/associola.c:1048
 sctp_inq_push+0x25c/0x320 net/sctp/inqueue.c:91
 sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:331
 sk_backlog_rcv include/net/sock.h:1194 [inline]
 __release_sock+0x39d/0x440 net/core/sock.c:3341
 release_sock+0x1e5/0x280 net/core/sock.c:3940
 sctp_sendmsg+0x1166/0x22e0 net/sctp/socket.c:2091
 inet_sendmsg+0x11c/0x140 net/ipv4/af_inet.c:864
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0xa23/0xc30 net/socket.c:2715
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
 __sys_sendmmsg+0x20c/0x440 net/socket.c:2858
 __do_sys_sendmmsg net/socket.c:2885 [inline]
 __se_sys_sendmmsg net/socket.c:2882 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2882
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff80879fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff70bcd848 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007ff808a25fa0 RCX: 00007ff80879fb19
RDX: 0000000000000001 RSI: 0000200000000e40 RDI: 0000000000000004
RBP: 00007ff808837b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff808a25fac R14: 00007ff808a25fa0 R15: 00007ff808a25fa0
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__pskb_pull_tail+0x1335/0x1920 net/core/skbuff.c:2903
Code: 5b f8 48 89 df e8 2b 03 fe ff 31 ff 41 89 c4 89 c6 e8 7f 58 5b f8 45 84 e4 0f 84 1c f2 ff ff e9 84 f2 ff ff e8 5c 5e 5b f8 90 <0f> 0b e8 54 5e 5b f8 48 8b 54 24 30 48 b8 00 00 00 00 00 fc ff df
RSP: 0018:ffffc90000648870 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000fffffff2 RCX: 0000000000000101
RDX: ffff88802ce60000 RSI: ffffffff89b30684 RDI: 0000000000000005
RBP: ffffc900006488f0 R08: 0000000000000000 R09: 00000000fffffff2
R10: ffff888046a12f77 R11: 0000000000000000 R12: 00000000000000e4
R13: 0000000000000180 R14: 0000000000000000 R15: ffff888030406780
FS:  000055558120b500(0000) GS:ffff8880d467c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000001a000 CR3: 00000000385f5000 CR4: 0000000000352ef0


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Forwarded: [PATCH] net: sctp: linearize cloned gso packets in sctp_rcv

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] net: sctp: linearize cloned gso packets in sctp_rcv
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


Fix a kernel panic bug caused by an unexpected layout geometry mismatch
when flattening cloned non-linear SCTP GSO packets.

When an incoming packet is cloned (e.g., during packet capturing via
tcpdump or Wireshark), sctp_rcv() must flatten the packet into a single,
continuous memory block before parsing its chunks. However, if the packet's
internal frag_list has tracking discrepancies, calling downstream memory
handlers like __pskb_pull_tail() triggers an operational failure.
Because the kernel treats this failure as an invariant violation, it
executes a fatal BUG_ON() assertion, resulting in a system-wide panic.

Fix this issue by validating memory linearization early in sctp_rcv().
By intercepting non-zero return codes from skb_linearize(), the kernel
can detect frag_list length discrepancies before they reach the core
network buffer handlers, allowing malformed packets to be safely routed
to the discard routine rather than crashing the operating system.

Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
Fixes: 90017accff61 ("sctp: support GSO")
Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 net/sctp/input.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index 9494cfa51106..6f66ae656d70 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -116,8 +116,13 @@ int sctp_rcv(struct sk_buff *skb)
 	/* If the packet is fragmented and we need to do crc checking,
 	 * it's better to just linearize it otherwise crc computing
 	 * takes longer.
+	 *
+	 * If there is a geometry mismatch, length discrepancy, or offset corruption
+	 * in the packet, skb_linearize will fail and return
+	 * a non-zero error code.
 	 */
-	if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) ||
+
+	if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb) != 0) ||
 	    !pskb_may_pull(skb, sizeof(struct sctphdr)))
 		goto discard_it;
 
-- 
2.56.0

Forwarded: [PATCH] net: skbuff: convert BUG_ON to warning and error return during linearization

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] net: skbuff: convert BUG_ON to warning and error return during linearization
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


When receiving an SCTP packet that is nonlinear (such as an SCTP GSO packet
constructed with fragments in frag_list), sctp_rcv attempts to linearize
the packet using skb_linearize() if the sk_buff is cloned (e.g.,
tapped by a packet socket or shared) or not recognized as GSO. During
linearization via __skb_linearize() and __pskb_pull_tail(),
skb_copy_bits() fails with -EFAULT due to a discrepancy in frag_list fragment
lengths or readable offsets, triggering a BUG_ON assertion failure.
In production builds, this BUG() results in an invalid opcode oops
and kernel panic, causing an immediate denial of service.

Fix this issue by removing the fatal BUG_ON() assertion in the core
network buffer layer (__pskb_pull_tail) when skb_copy_bits() encounters a
layout or length mismatch. Instead, log a rate-limited error message using
pr_err_ratelimited() and return NULL.

Reported-by: syzbot+f15a6eff7a53f6eb7dc3@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f15a6eff7a53f6eb7dc3
Fixes: 90017accff61 ("sctp: support GSO")

Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 net/core/skbuff.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 48f676411724..f76fe6972859 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2900,8 +2900,12 @@ void *__pskb_pull_tail(struct sk_buff *skb, int delta)
 			return NULL;
 	}
 
-	BUG_ON(skb_copy_bits(skb, skb_headlen(skb),
-			     skb_tail_pointer(skb), delta));
+	if (unlikely((skb_copy_bits(skb, skb_headlen(skb),
+			     skb_tail_pointer(skb), delta))){
+		pr_err_ratelimited("skbuff: length discrepancy"
+				   "detected in %s.\n", __func__);
+		return NULL;
+	}
 
 	/* Optimization: no fragments, no reasons to preestimate
 	 * size of pulled pages. Superb.
-- 
2.56.0